Data breach notification laws by state: the statute for all 50 states and DC

A breach notification law makes an organization that loses certain personal information tell the people affected. The National Conference of State Legislatures (NCSL) tracks these laws and summarizes the common elements as: who must comply (businesses, data brokers, government entities), definitions of personal information (such as name combined with a Social Security number, driver's license or state ID, or account numbers), what counts as a breach, requirements for notice (timing, method, who must be told), and exemptions, for example for encrypted information (NCSL, Security Breach Notification Laws).

That is why breach letters look so alike. They are written to satisfy these statutes, and some states require specific content, such as contact details for the credit bureaus and the FTC. Some states also require a copy to go to the state attorney general; that is why AG websites in states like Maine, California and Washington publish lists of breach notices.

What these laws generally do not do is require the company to fix anything for you. Free credit monitoring is often offered, and a few states require it after certain breaches, but the protection that works is in your hands.

1. Read which data types were involved. That list decides your next steps, as our data breach triage guide explains.
2. If a Social Security number, ID number or date of birth was involved, freeze your credit at all three bureaus. The federal Economic Growth, Regulatory Relief, and Consumer Protection Act made freezes free nationwide from September 21, 2018 (FTC), so state freeze fee rules no longer matter.
3. Check your free credit reports at AnnualCreditReport.com. See how to get and read them.
4. Look up the notice on your state attorney general's website if you doubt a letter is real, and never call a number or click a link that only appears in an email.

Citations come from NCSL's compiled list (last updated January 17, 2022), with obvious typos in that list corrected against the linked statute. "Government" is the statute NCSL lists for state agencies, where it differs or is listed. Links go to the statute on the legislature's or official code site as NCSL links it; where NCSL gives no stable link, the row links NCSL. States amend these laws, so check the current text.

NCSL also lists laws for Guam (9 GCA § 48-10 et seq.), Puerto Rico (10 LPRA § 4051 et seq.) and the US Virgin Islands (V.I. Code tit. 14, § 2209 for the private sector).

The table tells you where each state's law is, not what it currently requires. Deadlines, the definition of personal information and attorney general reporting thresholds vary and have been amended many times. If you run a business that has had a breach, read the current statute for every state where affected people live and talk to a lawyer; our small business security checklist covers the prevention side. If you are an individual, the identity theft recovery plan is the place to start when a breach turns into fraud.